It is attempted to specify, in a plurality of services including a plurality of predetermined processes, for example, in an application program or a network service, a process in which an abnormality such as delay occurs. For example, a method is available by which, when delay of a service (response) occurs, a log outputted from each process is analyzed to detect an abnormal (problem) point (portion) and ascertains the cause under an actually operating situation.
It is to be noted that the abnormal point signifies a point (process, component) in a Web request or the like at which an abnormality such as delay occurs in an apparatus that configures a system or a network. For example, as an abnormal point, a delay interval of a network, a DB or a cable having a delay cause of a Relational Database (RDB), a method of a delay cause of an application or the like from within a network configuring a system, an RDB, an application or the like are listed.
As an example, an abnormal point of a service can be found out by sampling logs before and after each process of a service and continuously monitoring a state by a monitoring process. For example, in the case of a processing sequence of start-A-B-C-D-end, by sampling logs to which timestamps just before A, intermediate between A and B, intermediate between B and C, intermediate between C and D and just before D are applied, delay in the processes of A to D can be found out. For example, when the process B suffers from delay, the process B can be specified as an abnormal point (abnormal process) by referring to the log just before B (between A and B) and the log just after B (between B and C).
[Patent Document 1] Japanese Laid-Open Patent Publication No. 2007-264734
[Patent Document 2] International Publication Pamphlet No. WO 2008/129635
[Patent Document 3] Japanese Laid-Open Patent Publication No. 2013-097783
It seems a recommendable idea to configure an analysis apparatus that performs analysis and detection of an abnormal point such that the analysis apparatus stores processes (components) to be executed by individual services in advance and detects a process having a high degree of possibility that it may have an influence on delay from among a plurality of services executed when delay occurs.
However, in order to detect an abnormal point in each service, the monitoring apparatus samples a great amount of logs at a great number of monitoring points. Therefore, a great amount of execution overheads and network loads are generated upon filtering and specification of an abnormal point. In this manner, since sampling and analysis of logs outputted from individual processes involves increase of the load in a network and so forth, increased time is used for detection as the number of processes included in a service increases and an influence is sometimes had on service provision of the system.
Further, it seems recommendable to configure the monitoring apparatus such that the man-hour for detection is decreased by integrating processes executed by services in a predetermined unit. However, depending upon the unit for integrating the processes, there is the possibility that a process to be found as an abnormal process may be hidden and an abnormal point may be difficult to detect.